ZkWasm Rollup Grant Amendment

[ashWhiteHat]

Hi there

We would like to amend our grants.
The main changes are as follows.

• Implement Nova folding instead of Plonk
• Remove Zkwasm Rollup

We tried to estimate how the ZkWasm Rollup reduces gas costs by benchmarking a similar scheme ZkRollup in advance.
However, the overhead was larger than the reduced computation amount by Rollup.

Rollup

Rollup is a technology to collect a bunch of transactions on an off-chain single node and applies the changes on the on-chain. The off-chain computation is executed by a single node but zero knowledge proof causes overhead during proof generation.

The on-chain computation is executed by network participating nodes and the Polkadot has about 297 nodes.
https://polkadot.js.org/apps/?rpc=wss%3A%2F%2Frpc.polkadot.io#/staking

If the zero-knowledge overhead is more than 297 times the computation amount than usual execution, Rollup wouldn't work as a scaling solution.

Benchmark results suggested that zero-knowledge proof caused a million to a hundred million overhead than normal execution. Moreover, the Polkadot has a significant scaling roadmap including coretime. We think the Polkadot is already scalable so we should focus on extending functionalities with zero knowledge.

Nova

We did some research about the latest zero-knowledge proof to reduce the cost of Rollup or support new blockchain functionalities as follows.
Brief Introduction of Latest Zero Knowledge Proof such as ZKVM, Recursion and Lookup

As a conclusion, the Rollup is not reasonable even if we use the latest zero knowledge scheme because we need to pay other costs for ZKVM such as security, development cost and so on. We think it’s better to use zero-knowledge for extending blockchain functionalities instead of scaling.

We would like to support Recursive Snarks with Nova folding. Nova folding is the latest zero-knowledge proof and far more efficient than Plonk that we supported. There is no Polkadot compatible Recursive Snarks pallet thus it’s beneficial for the community to support it. It can use zero-knowledge proof with cheap cost and help to extend blockchain functionality.

We did experiment implementation as follows.
https://github.com/ashWhiteHat/nova

Milestones

In recursive Snarks, provers generate the proof for proof recursively on an off-chain and need to verify the validity of the process on zero knowledge circuit. Proving and verification are done in different fields and it causes 100 times overhead. To avoid that overhead, we are going to support a curve which supports the cycle of curves.

To verify the off-chain verifier circuit, we are going to implement Groth16. And finally, we are going to implement Nova folding pallet and allow developers to use recursive Snarks on the Substrate.

Really sorry for the amendment and inconvenience.
I would appreciate it if you could confirm.

[github-actions]

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

[ashWhiteHat]

I have read and hereby sign the Contributor License Agreement.

[keeganquigley]

Thanks for the amendment @ashWhiteHat. If milestones 3 & 4 are being removed completely, I believe that the Total Costs for the grant would be $20k now instead of $40k. Can you adjust this? Thanks!

[ashWhiteHat]

Hi @keeganquigley
Thank you for the review.
I adjusted the Total Cost and Estimated Duration.

I would appreciate it if you could confirm.

[keeganquigley]

Thanks @ashWhiteHat looks good. I will mark it as ready for review and ping the rest of the committee.

[ashWhiteHat]

Could we pend this PR?
I would like to research about cycle of curves more.
I may change pasta to bn254/Grumpkin curves.
Could you give me couple of days?

[ashWhiteHat]

Hi there

I changed pasta to bn254/grumpkin.
We want constant time verifier Recursive Snarks construction and need half-pairing cycle of curves.

This PR is ready.
Sorry for inconvenient.

I would appreciate it if you could confirm.
Thank you!

[keeganquigley]

No worries @ashWhiteHat thanks for the explanation, much appreciated. LGTM.